Gate public event forms on the public-registration flag - #2049
Draft
maebeale wants to merge 7 commits into
Draft
Conversation
Consolidate the dashboard's inline quick-links row into a top-right Forms dropdown (below the sub-nav), reusing the parameterized form_actions_menu partial the registrants page already uses. Its "Manage forms" item deep-links to the Edit-event form-settings section so admins have one obvious path to configure forms. Also clarify the registration display toggle copy: "Show event details at top of registration form". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Both pages share _form_actions_menu, so make its defaults the shared labels (Forms button, Edit form settings) and rename the public-form items to Registration form / Scholarship form. Only sample_return_to differs per page so each eyebrow returns to its origin. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… registration Scholarship and bulk payment links only make sense with a fee, so show them only when the event has a cost. The registration link shows only when a registration form is selected, and reads 'Public registration form' when public registration is enabled (the flag reflects public advertising, not access — so it doesn't affect the other links). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Gate access to the public registration, scholarship, and bulk-payment form pages on the event's public_registration_enabled flag: anonymous visitors need the flag on; signed-in users and admins always may. This mirrors the register button, which already only advertises registration to anonymous visitors when the flag is on — closing the direct-URL gap. Registration/scholarship go through Events::PublicRegistrationPolicy (new?/create? = admin? || public_registration_enabled? || authenticated?); bulk payment uses a controller before_action with the same rule. Forms dropdown: hide the registration link when one-click is on and public registration is off (nobody hits the form page then); prefix all three links with 'Public' when public registration is enabled. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move the public-form access-control changes (policy/controller gating and the one-click-based link hiding) to a separate PR. This PR keeps just the Forms dropdown: the links, cost-gating of scholarship/bulk payment, and the 'Public …' label prefix keyed on public_registration_enabled? as a display marker (its meaning before the permissioning work). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Anonymous visitors may only reach the public registration, scholarship, and bulk-payment form pages when the event's public_registration_enabled flag is on; signed-in users and admins always may. Mirrors the register button, which already only advertises registration to anonymous visitors when the flag is on — closing the direct-URL gap. - Events::PublicRegistrationPolicy#new?/create? = admin? || public_registration_enabled? || authenticated? (covers the registration + scholarship pages, same controller). - BulkPaymentFormSubmissionsController gets an equivalent before_action. - Forms dropdown: hide the registration link when one-click is on and public registration is off (nobody reaches the form page then). - Adds a :publicly_registerable factory trait; access + one-click specs. Stacked on #2046 (Forms dropdown). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 suggested review level: 5 Inspect 🔬 behavior change — anonymous access to public forms now depends on the public-registration flag
What is the goal of this PR and why is this important?
How did you approach the change?
Events::PublicRegistrationPolicy#new?/create?→admin? || public_registration_enabled? || authenticated?(covers registration + scholarship — same controller;authorize! @event, with: …so the policy sees the event).BulkPaymentFormSubmissionsControllergets an equivalentbefore_action.:publicly_registerablefactory trait; existing anonymous specs use it, plus new access-control + one-click specs.Anything else to add?